Buggy code:
public class CorsResponseHelper { private static Logger LOGGER = Context . getCurrentLogger ( ) ; public boolean allowAllRequestedHeaders = true ; public boolean allowedCredentials = false ; public Set < String > allowedHeaders = null ; public Set < String > allowedOrigins = SetUtils . newHashSet ( "*" ) ; public Set < String > exposedHeaders = null ; public void addCorsResponseHeaders ( Request request , Response response ) { String origin = request . getHeaders ( ) . getFirstValue ( "Origin" , true ) ; if ( origin == null ) { return ; } Set < Method > allowedMethods = new java . util . HashSet ( response . getAllowedMethods ( ) ) ; response . getAllowedMethods ( ) . clear ( ) ; if ( ( ! ( allowedOrigins . contains ( "*" ) ) ) && ( ! ( allowedOrigins . contains ( origin ) ) ) ) { CorsResponseHelper . LOGGER . fine ( ( ( "Origin<seq2seq4repair_space>" + origin ) + "<seq2seq4repair_space>not<seq2seq4repair_space>allowed<seq2seq4repair_space>for<seq2seq4repair_space>CORS<seq2seq4repair_space>request" ) ) ; return ; } boolean isPreflightRequest = OPTIONS . equals ( request . getMethod ( ) ) ; if ( isPreflightRequest ) { if ( ( ( SUCCESS_OK . equals ( response . getStatus ( ) ) ) || ( SUCCESS_NO_CONTENT . equals ( response . getStatus ( ) ) ) ) || ( CLIENT_ERROR_METHOD_NOT_ALLOWED . equals ( response . getStatus ( ) ) ) ) { response . setStatus ( SUCCESS_OK ) ; } else { CorsResponseHelper . LOGGER . fine ( "The<seq2seq4repair_space>CORS<seq2seq4repair_space>preflight<seq2seq4repair_space>request<seq2seq4repair_space>failed<seq2seq4repair_space>in<seq2seq4repair_space>server<seq2seq4repair_space>resource." ) ; return ; } Method requestedMethod = request . getAccessControlRequestMethod ( ) ; if ( requestedMethod == null ) { CorsResponseHelper . LOGGER . fine ( "A<seq2seq4repair_space>CORS<seq2seq4repair_space>preflight<seq2seq4repair_space>request<seq2seq4repair_space>should<seq2seq4repair_space>specified<seq2seq4repair_space>header<seq2seq4repair_space>'Access-Control-Request-Method'" ) ; return ; } if ( ! ( allowedMethods . contains ( requestedMethod ) ) ) { CorsResponseHelper . LOGGER . fine ( "The<seq2seq4repair_space>CORS<seq2seq4repair_space>preflight<seq2seq4repair_space>request<seq2seq4repair_space>ask<seq2seq4repair_space>for<seq2seq4repair_space>methods<seq2seq4repair_space>not<seq2seq4repair_space>allowed<seq2seq4repair_space>in<seq2seq4repair_space>header<seq2seq4repair_space>'Access-Control-Request-Method'" ) ; return ; } Set < String > requestedHeaders = request . getAccessControlRequestHeaders ( ) ; if ( requestedHeaders == null ) { requestedHeaders = SetUtils . newHashSet ( ) ; } if ( ( ! ( allowAllRequestedHeaders ) ) && ( ( ( allowedHeaders ) == null ) || ( ! ( isAllHeadersAllowed ( allowedHeaders , requestedHeaders ) ) ) ) ) { CorsResponseHelper . LOGGER . fine ( "The<seq2seq4repair_space>CORS<seq2seq4repair_space>preflight<seq2seq4repair_space>request<seq2seq4repair_space>ask<seq2seq4repair_space>for<seq2seq4repair_space>headers<seq2seq4repair_space>not<seq2seq4repair_space>allowed<seq2seq4repair_space>in<seq2seq4repair_space>header<seq2seq4repair_space>'Access-Control-Request-Headers'" ) ; return ; } response . setAccessControlAllowMethods ( allowedMethods ) ; response . setAccessControlAllowHeaders ( requestedHeaders ) ; } else { if ( ( ( exposedHeaders ) != null ) && ( ! ( exposedHeaders . isEmpty ( ) ) ) ) { response . setAccessControlExposeHeaders ( exposedHeaders ) ; } } if ( allowedCredentials ) { <START_BUG> response . setAccessControlAllowCredential ( true ) ; <END_BUG> } if ( ( ! ( allowedCredentials ) ) && ( allowedOrigins . contains ( "*" ) ) ) { response . setAccessControlAllowOrigin ( "*" ) ; } else { response . setAccessControlAllowOrigin ( origin ) ; } } public Set < String > getAllowedHeaders ( ) { } public Set < String > getAllowedOrigins ( ) { } public Set < String > getExposedHeaders ( ) { } private boolean isAllHeadersAllowed ( Set < String > allowHeaders , Set < String > requestedHeaders ) { } public boolean isAllowAllRequestedHeaders ( ) { } public boolean isAllowedCredentials ( ) { } public boolean isCorsRequest ( Request request ) { } public void setAllowAllRequestedHeaders ( boolean allowAllRequestedHeaders ) { } public void setAllowedCredentials ( boolean allowedCredentials ) { } public void setAllowedHeaders ( Set < String > allowedHeaders ) { } public void setAllowedOrigins ( Set < String > allowedOrigins ) { } public void setExposedHeaders ( Set < String > exposedHeaders ) { } }

Fix:
response . setAccessControlAllowCredentials ( true ) ;